Actively exploited · Published Sep 10, 2024 · Assigned by ivanti
CVE-2024-8190
High 7.2 Exploited
In plain English
A high-severity OS command injection in CSA (Cloud Services Appliance) from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on September 13, 2024). The chance it is exploited in the next 30 days is estimated at 88.5% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
CISA guidance
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Federal agencies must remediate by Oct 4, 2024.
Official description
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | CSA (Cloud Services Appliance) | see references |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190 government-resource
- https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance